@0xwork/cli 1.0.0 → 1.1.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@0xwork/cli",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "0xWork CLI — AI agents earn money on-chain. Discover tasks, claim work, submit deliverables, earn USDC.",
   "bin": {
     "0xwork": "./bin/0xwork.js"

package/src/commands/post.js

@@ -8,6 +8,14 @@ const { fmtBounty, fmtDeadline, fmtAxobotl } = require('../format');
 
 const VALID_CATEGORIES = ['Writing', 'Research', 'Code', 'Creative', 'Data', 'Social'];
 
+// ─── Spending Guardrails ────────────────────────────────────────────
+// Two layers of protection for agents interacting with unaudited escrow:
+//  1. Percentage cap: never lock more than MAX_BOUNTY_PERCENT of USDC balance (default 20%)
+//  2. Absolute cap:   never post more than MAX_BOUNTY_USDC in a single task (default $50)
+// Both can be overridden via env vars or --force flag for experienced users.
+const DEFAULT_MAX_BOUNTY_PERCENT = parseFloat(process.env.MAX_BOUNTY_PERCENT || '20');
+const DEFAULT_MAX_BOUNTY_USDC    = parseFloat(process.env.MAX_BOUNTY_USDC    || '50');
+
 function register(program) {
   program
     .command('post')
@@ -16,6 +24,7 @@ function register(program) {
     .requiredOption('--bounty <amount>', 'Bounty in USDC (e.g. 10)')
     .option('--category <cat>', 'Category: Writing, Research, Code, Creative, Data, Social', 'Code')
     .option('--deadline <dur>', 'Deadline: 7d, 24h, 30m (default: 7d)', '7d')
+    .option('--force', 'Bypass spending guardrails (percentage + absolute cap)')
     .action(async (opts) => {
       try {
         await run(opts);
@@ -90,6 +99,28 @@ async function run(opts) {
     fail(`Need ${fmtBounty(bountyNum)} USDC`, { suggestion: `Have: ${fmtBounty(ethers.formatUnits(usdcBalance, 6))}. Send USDC on Base to ${address}` });
   }
 
+  // ── Spending guardrails ──
+  if (!opts.force) {
+    const balanceNum = parseFloat(ethers.formatUnits(usdcBalance, 6));
+
+    // 1. Absolute cap
+    if (bountyNum > DEFAULT_MAX_BOUNTY_USDC) {
+      s1.fail('Bounty exceeds safety cap');
+      fail(`Bounty $${bountyNum} exceeds max $${DEFAULT_MAX_BOUNTY_USDC} per task`, {
+        suggestion: `Set MAX_BOUNTY_USDC in .env to raise the limit, or use --force to bypass.`,
+      });
+    }
+
+    // 2. Percentage cap
+    const pctUsed = (bountyNum / balanceNum) * 100;
+    if (pctUsed > DEFAULT_MAX_BOUNTY_PERCENT) {
+      s1.fail('Bounty exceeds balance percentage cap');
+      fail(`Bounty $${bountyNum} is ${pctUsed.toFixed(1)}% of your $${balanceNum.toFixed(2)} balance (max ${DEFAULT_MAX_BOUNTY_PERCENT}%)`, {
+        suggestion: `Set MAX_BOUNTY_PERCENT in .env to raise the limit, or use --force to bypass.`,
+      });
+    }
+  }
+
   const posterStake = await sdk.taskPool.calculatePosterStake(bountyAmount);
   if (posterStake > 0n) {
     const axobotlBalance = await sdk.axobotl.balanceOf(address);